Skip to content
ENExplore Calculators

Malware Spread Calculator

Model worm or malware propagation with an SIR epidemic model: R0, doubling time, projected infections and containment threshold.

About Malware Spread Calculator

This is the standard deterministic SIR model applied to hosts instead of people. β captures how aggressively the malware reaches out and how often that lands, γ captures how fast your team removes hosts from the infected pool, and R0 is their ratio — the single number that decides whether an outbreak grows or dies. Because the model is deterministic and homogeneous-mixing, treat it as an order-of-magnitude prioritisation estimate rather than a prediction of specific hosts. R0 tells you whether the answer is 'clean the infected machines' or 'pull the network cable', and that decision usually has to be made in the first hour with exactly these few numbers.

Formulas

Malware Spread

β = contactRate × infectionProbability; γ = 1 ÷ meanRemediationDays; R0 = β ÷ γ. Growth = β × (S ÷ N) − γ, and the doubling time is ln 2 ÷ growth.

β
New infections caused per infected host per day
γ
Rate at which infected hosts are returned to service clean
R0
Secondary infections per infected host before it is cleaned
S ÷ N
Share of the estate still susceptible

Final epidemic size

The final attack size solves z = 1 − e^(−R0·z) by fixed-point iteration; total infected ≈ initial + z × susceptible.

z
Fraction of the susceptible population eventually infected
R0
Basic reproduction number

Worked example

With the default values below, Malware Spread Calculator returns Basic Reproduction Number R₀ of 5.40. Change any input above and every figure here is recalculated in your browser.

Inputs used

Reachable hostsaccepts 2–10,000,000 hosts
5,000 hosts
Hosts infected at detectionaccepts 1–1,000,000 hosts
3 hosts
Susceptible hosts contacted per infected host per dayaccepts 0.1–10,000 contacts/day
12 contacts/day
Probability a contact succeedsaccepts 0.1–100 %
18 %
Hosts already immune — patched or hardenedaccepts 0–100 %
20 %
Mean days to clean an infected hostaccepts 0.05–90 days
2.5 days
Projection horizonaccepts 1–365 days
14 days

Results

Basic Reproduction Number R₀
5.40
Infection Doubling Time
0.52 days
Infected at the Horizon
4,000 hosts
Projected Total Infected
3,981 hosts
Final Attack Rate
79.6%
Remediation Time Needed for R₀ < 1
0.58 days
Containment Verdict
Explosive — isolate the segment now; host-by-host cleanup will not keep up

Step by step

  1. 1Values used
  2. 2Malware Spread
  3. 3Final epidemic size
  4. 4Basic Reproduction Number R₀= 5.40
  5. 5Infection Doubling Time= 0.52 days
  6. 6Infected at the Horizon= 4,000 hosts
  7. 7Projected Total Infected= 3,981 hosts
  8. 8Final Attack Rate= 79.6
  9. 9Remediation Time Needed for R₀ < 1= 0.58 days

Assumptions and limits

  • The result is derived only from the 7 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Malware Spread calculated?

β = contactRate × infectionProbability; γ = 1 ÷ meanRemediationDays; R0 = β ÷ γ. Growth = β × (S ÷ N) − γ, and the doubling time is ln 2 ÷ growth. This is the standard deterministic SIR model applied to hosts instead of people. β captures how aggressively the malware reaches out and how often that lands, γ captures how fast your team removes hosts from the infected pool, and R0 is their ratio — the single number that decides whether an outbreak grows or dies. Because the model is deterministic and homogeneous-mixing, treat it as an order-of-magnitude prioritisation estimate rather than a prediction of specific hosts.

Why does Malware Spread matter?

R0 tells you whether the answer is 'clean the infected machines' or 'pull the network cable', and that decision usually has to be made in the first hour with exactly these few numbers.

What values do I need to enter?

This calculator takes 7 inputs: Reachable hosts, Hosts infected at detection, Susceptible hosts contacted per infected host per day, Probability a contact succeeds, Hosts already immune — patched or hardened, Mean days to clean an infected host, Projection horizon. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why does segmentation help so much?

Because it cuts the contact rate directly, and β is linear in contact rate. Halving reachable neighbours halves R0, which is often the difference between an outbreak that grows and one that burns out on its own.

Is homogeneous mixing realistic on a real network?

No — real estates are clustered, so early spread is usually faster inside a subnet and slower between them than the model says. Use it to decide direction and urgency, not to forecast an exact host count.

Related Calculators

Malware Spread Calculator | Calcrivo